@@ -1239,6 +1239,121 @@ The assessment criteria for each security requirements are described in a struct
## 6.7 Integrity
## 6.8 Data minimisation
### 6.8.1 General
### 6.8.2 Secret management
- REFERENCE: ACC_PKI_DM_001
- OBJECTIVE: Verify the product only creates keys by means of a secure cryptographic device appropriate for this use.
- PREPARATION: Document the profiles of private and symmetric keys manipulated by the product, and how they are created by the product.
- ACTIVITIES: Verify that all keys are created by an appropriate secure cryptographic device.
- VERDICT: SUCCESS if the verification passes; else FAIL.
- EVIDENCE:
a) The documentation of private and symmetric keys profiles and how these keys are created.
- REFERENCE: ACC_PKI_DM_002
- OBJECTIVE: Verify the product does not persistently store private or symmetric keys in plaintext form.
- PREPARATION: Document the profiles of private and symmetric keys manipulated by the product, and how they are manipulated by the product.
- ACTIVITIES: Verify that keys accessed in plaintext form are only used to perform a single operation once, or operations in a single batch.
- VERDICT: SUCCESS if the verification passes; else FAIL.
- EVIDENCE:
a) The documentation of private and symmetric keys profiles and how these keys are manipulated.
- REFERENCE: ACC_PKI_DM_003
- OBJECTIVE: Verify public keys stored within the product outside a secure cryptographic device are protected against undetected modification, and that public keys are not released or used after a detected modification.
- PREPARATION: Document public keys manipulated by the product outside a secure cryptographic device, and how they are manipulated by the product.
- Ability to directly modify such a stored public key. Ability to directly modify digital signatures, keyed hashes, or authentication codes associated to such stored public keys.
- Ability to request the public key (if applicable). Ability to trigger an action of the product making it use the public key (if applicable).
- ACTIVITIES: For every public key stored within the product outside a secure cryptographic device:
a) directly modify the stored public key;
b) attempt to request the public key;
c) verify the request fails;
d) attempt to trigger an operation whereby the product makes use of the public key;
e) verify the operation fails because of the state of the public key;
f) restore the stored public key;
g) directly modify the digital signature, keyed hash, or authentication code associated to the stored public key;
h) attempt to request the public key;
i) verify the request fails;
j) attempt to trigger an operation whereby the product makes use of the public key;
k) verify the operation fails because of the state of the public key.
- VERDICT: SUCCESS if all the verifications pass; else FAIL.
- EVIDENCE:
a) The documentation of public keys and how they are manipulated;
b) the way the public keys were requested, and the response from the product;
c) the way operations making use of public keys were attempted to be triggered, and the response from the product;
- REFERENCE: ACC_PKI_DM_004
- OBJECTIVE: Verify the product zeroizes secrets in plaintext form.
- PREPARATION: Document secrets manipulated by the product in plaintext form outside a secure cryptographic device. Access to product source codes.
- ACTIVITIES:
a) For every such secret, verify related source codes systematically perform its secure zeroization after the secret is used;
b) For every zeroization method employed, identify a related secret in memory while it is used, and verify the secret to be irrecoverable in full after zeroization.
- VERDICT: SUCCESS if all the verifications pass; else FAIL.
- EVIDENCE:
a) The documentation of secrets and how they are manipulated;
b) the documentation of zeroization methods employed.
- REFERENCE: ACC_PKI_DM_005
- OBJECTIVE: Verify the product cannot export private or symmetric keys in plaintext form.
- PREPARATION: Document how private and symmetric keys may be exported by the product.
- ACTIVITIES: For each method of export, verify the secret key is not in plaintext form.
- VERDICT: SUCCESS if all the verifications pass; else FAIL.
- EVIDENCE: The documentation of supported export methods.
